linux-kernel - [GIT PULL] KVM: x86: SVM changes for 6.20

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20260207041011.913471-8-seanjc@google.com>
Date: Fri,  6 Feb 2026 20:10:09 -0800
From: Sean Christopherson <seanjc@...gle.com>
To: Paolo Bonzini <pbonzini@...hat.com>
Cc: kvm@...r.kernel.org, linux-kernel@...r.kernel.org, 
	Sean Christopherson <seanjc@...gle.com>
Subject: [GIT PULL] KVM: x86: SVM changes for 6.20

Complete the "u64 exit_code" cleanup, start fixing nSVM issues (a lot more of
those will be coming in the near future), virtualize EPAPS, and support for
fetching SNP certificates.

The following changes since commit 9ace4753a5202b02191d54e9fdf7f9e3d02b85eb:

  Linux 6.19-rc4 (2026-01-04 14:41:55 -0800)

are available in the Git repository at:

  https://github.com/kvm-x86/linux.git tags/kvm-x86-svm-6.20

for you to fetch changes up to 20c3c4108d58f87c711bf44cb0b498b3ac5af6bf:

  KVM: SEV: Add KVM_SEV_SNP_ENABLE_REQ_CERTS command (2026-01-23 09:14:16 -0800)

----------------------------------------------------------------
KVM SVM changes for 6.20

 - Drop a user-triggerable WARN on nested_svm_load_cr3() failure.

 - Add support for virtualizing ERAPS.  Note, correct virtualization of ERAPS
   relies on an upcoming, publicly announced change in the APM to reduce the
   set of conditions where hardware (i.e. KVM) *must* flush the RAP.

 - Ignore nSVM intercepts for instructions that are not supported according to
   L1's virtual CPU model.

 - Add support for expedited writes to the fast MMIO bus, a la VMX's fastpath
   for EPT Misconfig.

 - Don't set GIF when clearing EFER.SVME, as GIF exists independently of SVM,
   and allow userspace to restore nested state with GIF=0.

 - Treat exit_code as an unsigned 64-bit value through all of KVM.

 - Add support for fetching SNP certificates from userspace.

 - Fix a bug where KVM would use vmcb02 instead of vmcb01 when emulating VMLOAD
   or VMSAVE on behalf of L2.

 - Misc fixes and cleanups.

----------------------------------------------------------------
Amit Shah (1):
      KVM: SVM: Virtualize and advertise support for ERAPS

Jim Mattson (2):
      KVM: SVM: Don't set GIF when clearing EFER.SVME
      KVM: SVM: Allow KVM_SET_NESTED_STATE to clear GIF when SVME==0

Kevin Cheng (1):
      KVM: SVM: Don't allow L1 intercepts for instructions not advertised

Michael Roth (2):
      KVM: Introduce KVM_EXIT_SNP_REQ_CERTS for SNP certificate-fetching
      KVM: SEV: Add KVM_SEV_SNP_ENABLE_REQ_CERTS command

Sean Christopherson (14):
      KVM: nSVM: Remove a user-triggerable WARN on nested_svm_load_cr3() succeeding
      KVM: SVM: Rename "fault_address" to "gpa" in npf_interception()
      KVM: SVM: Add support for expedited writes to the fast MMIO bus
      KVM: SVM: Drop the module param to control SEV-ES DebugSwap
      KVM: SVM: Tag sev_supported_vmsa_features as read-only after init
      KVM: SVM: Add a helper to detect VMRUN failures
      KVM: SVM: Open code handling of unexpected exits in svm_invoke_exit_handler()
      KVM: SVM: Check for an unexpected VM-Exit after RETPOLINE "fast" handling
      KVM: SVM: Filter out 64-bit exit codes when invoking exit handlers on bare metal
      KVM: SVM: Treat exit_code as an unsigned 64-bit value through all of KVM
      KVM: SVM: Limit incorrect check on SVM_EXIT_ERR to running as a VM
      KVM: SVM: Harden exit_code against being used in Spectre-like attacks
      KVM: SVM: Assert that Hyper-V's HV_SVM_EXITCODE_ENL == SVM_EXIT_SW
      KVM: SVM: Fix an off-by-one typo in the comment for enabling AVIC by default

Yosry Ahmed (5):
      KVM: selftests: Use TEST_ASSERT_EQ() in test_vmx_nested_state()
      KVM: selftests: Extend vmx_set_nested_state_test to cover SVM
      KVM: nSVM: Drop redundant/wrong comment in nested_vmcb02_prepare_save()
      KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation
      KVM: SVM: Stop toggling virtual VMSAVE/VMLOAD on intercept recalc

 Documentation/virt/kvm/api.rst                     |  44 +++++++
 .../virt/kvm/x86/amd-memory-encryption.rst         |  52 ++++++++-
 arch/x86/include/asm/cpufeatures.h                 |   1 +
 arch/x86/include/asm/kvm_host.h                    |   8 ++
 arch/x86/include/asm/svm.h                         |   9 +-
 arch/x86/include/uapi/asm/kvm.h                    |   2 +
 arch/x86/include/uapi/asm/svm.h                    |  32 ++---
 arch/x86/kvm/cpuid.c                               |   9 +-
 arch/x86/kvm/svm/avic.c                            |   4 +-
 arch/x86/kvm/svm/hyperv.c                          |   7 +-
 arch/x86/kvm/svm/nested.c                          |  82 ++++++++-----
 arch/x86/kvm/svm/sev.c                             | 129 ++++++++++++++-------
 arch/x86/kvm/svm/svm.c                             | 121 ++++++++++++++-----
 arch/x86/kvm/svm/svm.h                             |  49 ++++++--
 arch/x86/kvm/trace.h                               |   6 +-
 arch/x86/kvm/x86.c                                 |  12 ++
 include/hyperv/hvgdk.h                             |   2 +-
 include/uapi/linux/kvm.h                           |   9 ++
 tools/testing/selftests/kvm/Makefile.kvm           |   2 +-
 tools/testing/selftests/kvm/include/x86/svm.h      |   3 +-
 ...nested_state_test.c => nested_set_state_test.c} | 128 +++++++++++++++++---
 .../kvm/x86/svm_nested_soft_inject_test.c          |   4 +-
 22 files changed, 559 insertions(+), 156 deletions(-)
 rename tools/testing/selftests/kvm/x86/{vmx_set_nested_state_test.c => nested_set_state_test.c} (70%)